Google hit with blanket legal actions across Europe over its new “shared endorsements” policy

By Simon Davies

Formal complaints have today been lodged with national Data Protection Commissioners in fourteen European countries requesting an investigation into Google’s latest controversial changes to its Terms of Service and seeking suspension of the new policy.

Google has activated a “Shared Endorsements” policy that exploits the images, personal data and identities of its users to construe personal endorsements published alongside the company’s advertised products across the Internet.

In this way Google has triangulated the exploitation of user data by requiring users to create accounts that are content-scanned, by merging their data throughout the Google ecosystem and then by linking personal preferences, interactions, associations and views to its advertising network. This can be viewed as a “Perfect Storm” for online privacy

The new policy, which came into effect on November 11th 2013, allows the company to include adult users’ names, photos and comments in ads based on ratings, reviews and posts they have made on Google Plus and other Google services like YouTube. Google is now able to show automated Shared Endorsements on the more than two million sites in Google’s display advertising network.

This means if a user follows a car manufacturer on Google Plus or gives a music artist four stars on the Google Play music service, for example, that user’s name, photo and comments could show up as an endorsement in ads for that car or artist.

The complaints note that the Google initiative should be seen in the broader context of other changes recently made to the company’s Terms of Service that require users to log in or to create a Google+ account before being permitted to leave comments on YouTube. Not only are users now required to disclose their identity in order to interact on YouTube, but they are, by default, liable to have those comments and views construed as product endorsements in a generally visible publicly and identifiable format.

The technology is centred on a user’s Google+ identity, and it could be difficult for users to avoid Google+ within the new system. The social network and user identity hub has been steadily grafted onto all of the company’s popular services. Even if users believe they do not have a Google+ profile, there’s a good chance that one has been automatically created if they use Google’s other services.
Indeed all new users looking to create an account on YouTube, Gmail or any other Google product are now required to sign up for both Google+ and a Gmail account. Previously, an existing email address would allow users to set up an official Google Account. Now a name, Gmail username, Google+ account and gender are required. Thus a seamless data freeway between services is created that maximises the use of personal information.

“In this way Google has triangulated the exploitation of user data by requiring users to create accounts that are content-scanned, by merging their data throughout the Google ecosystem and then by linking personal preferences, interactions, associations and views to its advertising network. This can be viewed as a “Perfect Storm” for online privacy”, the complaint notes.

The legality of recent changes to Google’s policies that allow the company to share personal data across all its products and services are currently being investigated by a number of EU data protection authorities. The data protection issues and violations highlighted in my complaint go the heart of many of the aspects under investigation. Indeed the Shared Endorsements policy is made possible only through company-wide amalgamation of personal data.

Thus a seamless data freeway between services is created that maximises the use of personal information.

Central to this issue is the context for Google+, which the company has always promoted as a platform that encouraged true identities and true image likenesses. Contrast this to the YouTube context, which has traditionally been focused on the nature and content of comments, rather than on identities themselves. The new policy now creates a clash of context in which true identities are associated with personal views.

When users signed up for a Google+ account they were not informed that in order to use other Google services in the future, their data would be used for commercial purposes outside the Google+ environment.

Many users will be unaware of the ramifications of leaving comments and preferences on YouTube and other Google services. Full exposure of identities will be a fact known to some, but not all users.

“The central violation of data protection law occurs when data collected and disclosed for one purpose (say, expressing a view within the context of a closed social networking environment), is then published on an open Web platform for advertising and endorsement purposes.”